Academy Software Foundation Authentication

generated: '2026-08-29'
method: searched
source: https://github.com/AcademySoftwareFoundation/OpenCue/blob/master/docs/_docs/reference/rest-api-reference.md
docs: https://www.opencue.io/docs/
note: >-
  ASWF hosts no authenticated API of its own. The only authenticated interface any ASWF project
  ships is the OpenCue REST Gateway, which studios deploy inside their own network; the credential
  is therefore issued by the deploying studio, not by ASWF. The four OpenAPI documents in this repo
  were written by API Evangelist from documentation and declare no securityScheme, so this profile
  is taken from the provider's own REST API reference rather than derived from those specs.
schemes:
  - id: bearerAuth
    api: academy-software-foundation:academy-software-foundation-jobs-api
    type: http
    scheme: bearer
    bearer_format: JWT
    location: header
    header: Authorization
    value_prefix: 'Bearer '
    algorithm: HS256
    required_claims:
      - sub
      - exp
    issued_by: the studio operating the gateway (shared HMAC secret), not by ASWF
    applies_to: every gateway endpoint
    exceptions:
      - path: /swagger/
        note: >-
          The Swagger UI and the OpenAPI definitions it serves (/swagger/specs/<name>.swagger.json)
          are the only unauthenticated routes. When the documentation routes are disabled or
          SWAGGER_DIR is absent, /swagger/ falls through to the authenticated handler and returns 401.
    failure_codes:
      - status: 401
        meaning: Missing or invalid Authorization header
      - status: 403
        meaning: Token validation failed or expired
oauth2: false
openid_connect: false
mutual_tls: false
api_keys: false
guidance:
  - Tokens are expected to be short-lived; the reference recommends 1-2 hour expirations.
  - The reference requires HTTPS in production; the gateway itself speaks plain HTTP by default.
  - >-
    There is no ASWF-operated authorization server. /.well-known/oauth-authorization-server and
    /.well-known/openid-configuration were probed on every ASWF host and returned 404 (see
    well-known/academy-software-foundation-well-known.yml).